./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor2109040190

<...>
Warning: Permanently added '10.128.1.202' (ED25519) to the list of known hosts.
execve("./syz-executor2109040190", ["./syz-executor2109040190"], 0x7ffdb9e90230 /* 10 vars */) = 0
brk(NULL)                               = 0x555576911000
brk(0x555576911d00)                     = 0x555576911d00
arch_prctl(ARCH_SET_FS, 0x555576911380) = 0
set_tid_address(0x555576911650)         = 5219
set_robust_list(0x555576911660, 24)     = 0
rseq(0x555576911ca0, 0x20, 0, 0x53053053) = 0
prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0
readlink("/proc/self/exe", "/root/syz-executor2109040190", 4096) = 28
getrandom("\xec\xfe\x89\x90\x53\xb2\xf9\x68", 8, GRND_NONBLOCK) = 8
brk(NULL)                               = 0x555576911d00
brk(0x555576932d00)                     = 0x555576932d00
brk(0x555576933000)                     = 0x555576933000
mprotect(0x7f0451bdf000, 16384, PROT_READ) = 0
mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000
mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000
mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x555576911650) = 5220
./strace-static-x86_64: Process 5220 attached
[pid  5220] set_robust_list(0x555576911660, 24) = 0
[pid  5220] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid  5220] setpgid(0, 0)               = 0
[pid  5220] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid  5220] write(3, "1000", 4)         = 4
[pid  5220] close(3)                    = 0
executing program
[pid  5220] write(1, "executing program\n", 18) = 18
[pid  5220] capset({version=_LINUX_CAPABILITY_VERSION_1, pid=0}, {effective=0, permitted=0, inheritable=0}) = 0
[pid  5220] socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE) = 3
[pid  5220] bpf(BPF_TASK_FD_QUERY, NULL, 0) = -1 EPERM (Operation not permitted)
[pid  5220] bpf(BPF_OBJ_GET, NULL, 0)   = -1 EFAULT (Bad address)
[pid  5220] socket(AF_INET6, SOCK_DGRAM, IPPROTO_IP) = 4
[pid  5220] socket(AF_NETLINK, SOCK_DGRAM, NETLINK_GENERIC) = 5
[pid  5220] fcntl(-1, F_ADD_SEALS, F_SEAL_SEAL|F_SEAL_SHRINK|F_SEAL_WRITE) = -1 EBADF (Bad file descriptor)
[pid  5220] socket(AF_NETLINK, SOCK_RAW, NETLINK_NETFILTER) = 6
[pid  5220] add_key("keyring", "syz!", NULL, 0, KEY_SPEC_USER_SESSION_KEYRING) = 540158659
[pid  5220] add_key("keyring", "syz!", NULL, 0, 540158659) = 851124727
[pid  5220] pipe2([7, 8], O_EXCL)       = 0
[   77.616859][ T5220] capability: warning: `syz-executor210' uses 32-bit capabilities (legacy support in use)
[   77.674674][ T5220] ==================================================================
[   77.682782][ T5220] BUG: KASAN: slab-use-after-free in smk_access+0xae/0x4e0
[   77.690068][ T5220] Read of size 8 at addr ffff8880265cab00 by task syz-executor210/5220
[   77.698312][ T5220] 
[   77.700650][ T5220] CPU: 0 UID: 0 PID: 5220 Comm: syz-executor210 Not tainted 6.11.0-syzkaller-02574-ga430d95c5efa #0
[   77.711405][ T5220] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024
[   77.721551][ T5220] Call Trace:
[   77.724847][ T5220]  <TASK>
[   77.727769][ T5220]  dump_stack_lvl+0x241/0x360
[   77.732452][ T5220]  ? __pfx_dump_stack_lvl+0x10/0x10
[   77.737650][ T5220]  ? __pfx__printk+0x10/0x10
[   77.742246][ T5220]  ? _printk+0xd5/0x120
[   77.746412][ T5220]  ? __virt_addr_valid+0x183/0x530
[   77.751539][ T5220]  ? __virt_addr_valid+0x183/0x530
[   77.756662][ T5220]  print_report+0x169/0x550
[   77.761176][ T5220]  ? __virt_addr_valid+0x183/0x530
[   77.766292][ T5220]  ? __virt_addr_valid+0x183/0x530
[   77.771401][ T5220]  ? __virt_addr_valid+0x45f/0x530
[   77.776519][ T5220]  ? __phys_addr+0xba/0x170
[   77.781025][ T5220]  ? smk_access+0xae/0x4e0
[   77.785444][ T5220]  kasan_report+0x143/0x180
[   77.789963][ T5220]  ? smk_access+0xae/0x4e0
[   77.794383][ T5220]  smk_access+0xae/0x4e0
[   77.798644][ T5220]  smack_watch_key+0x2f4/0x3a0
[   77.803418][ T5220]  ? __pfx_smack_watch_key+0x10/0x10
[   77.808712][ T5220]  ? __kasan_kmalloc+0x98/0xb0
[   77.813475][ T5220]  security_watch_key+0x86/0x250
[   77.818417][ T5220]  keyctl_watch_key+0x2b7/0x480
[   77.823291][ T5220]  __se_sys_keyctl+0x106/0xa50
[   77.828060][ T5220]  ? __pfx___se_sys_keyctl+0x10/0x10
[   77.833348][ T5220]  ? _raw_spin_unlock_irq+0x23/0x50
[   77.838539][ T5220]  ? lockdep_hardirqs_on+0x99/0x150
[   77.843735][ T5220]  ? _raw_spin_unlock_irq+0x2e/0x50
[   77.848925][ T5220]  ? ptrace_notify+0x279/0x380
[   77.853684][ T5220]  ? __pfx_ptrace_notify+0x10/0x10
[   77.858793][ T5220]  ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10
[   77.865211][ T5220]  ? do_syscall_64+0x100/0x230
[   77.869997][ T5220]  ? __x64_sys_keyctl+0x20/0xc0
[   77.874851][ T5220]  do_syscall_64+0xf3/0x230
[   77.879369][ T5220]  ? clear_bhb_loop+0x35/0x90
[   77.884052][ T5220]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   77.889968][ T5220] RIP: 0033:0x7f0451b6cbf9
[   77.894383][ T5220] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 c1 17 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
[   77.913991][ T5220] RSP: 002b:00007fff281262e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000fa
[   77.922409][ T5220] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f0451b6cbf9
[   77.930383][ T5220] RDX: 0000000000000007 RSI: 0000000032bb21f7 RDI: 0000000000000020
[   77.938354][ T5220] RBP: 00007f0451bdf5f0 R08: 0000000000000000 R09: 0000000000000006
[   77.946341][ T5220] R10: 00000000000000b1 R11: 0000000000000246 R12: 0000000000000001
[   77.954312][ T5220] R13: 431bde82d7b634db R14: 0000000000000001 R15: 0000000000000001
[   77.962291][ T5220]  </TASK>
[   77.965315][ T5220] 
[   77.967629][ T5220] Allocated by task 4676:
[   77.971947][ T5220]  kasan_save_track+0x3f/0x80
[   77.976626][ T5220]  __kasan_kmalloc+0x98/0xb0
[   77.981222][ T5220]  __kmalloc_node_track_caller_noprof+0x225/0x440
[   77.987640][ T5220]  kstrdup+0x3a/0x80
[   77.991532][ T5220]  smack_inode_init_security+0x5d7/0x740
[   77.997169][ T5220]  security_inode_init_security+0x202/0x480
[   78.003070][ T5220]  shmem_mknod+0xc5/0x1e0
[   78.007401][ T5220]  path_openat+0x1c03/0x3590
[   78.012015][ T5220]  do_filp_open+0x235/0x490
[   78.016522][ T5220]  do_sys_openat2+0x13e/0x1d0
[   78.021197][ T5220]  __x64_sys_openat+0x247/0x2a0
[   78.026041][ T5220]  do_syscall_64+0xf3/0x230
[   78.030538][ T5220]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   78.036436][ T5220] 
[   78.038757][ T5220] Freed by task 4676:
[   78.042723][ T5220]  kasan_save_track+0x3f/0x80
[   78.047569][ T5220]  kasan_save_free_info+0x40/0x50
[   78.052600][ T5220]  poison_slab_object+0xe0/0x150
[   78.057536][ T5220]  __kasan_slab_free+0x37/0x60
[   78.062325][ T5220]  kfree+0x149/0x360
[   78.066225][ T5220]  security_inode_init_security+0x316/0x480
[   78.072118][ T5220]  shmem_mknod+0xc5/0x1e0
[   78.076471][ T5220]  path_openat+0x1c03/0x3590
[   78.081322][ T5220]  do_filp_open+0x235/0x490
[   78.085827][ T5220]  do_sys_openat2+0x13e/0x1d0
[   78.090505][ T5220]  __x64_sys_openat+0x247/0x2a0
[   78.095356][ T5220]  do_syscall_64+0xf3/0x230
[   78.099856][ T5220]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   78.105860][ T5220] 
[   78.108179][ T5220] The buggy address belongs to the object at ffff8880265cab00
[   78.108179][ T5220]  which belongs to the cache kmalloc-8 of size 8
[   78.121879][ T5220] The buggy address is located 0 bytes inside of
[   78.121879][ T5220]  freed 8-byte region [ffff8880265cab00, ffff8880265cab08)
[   78.135322][ T5220] 
[   78.137639][ T5220] The buggy address belongs to the physical page:
[   78.144048][ T5220] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff8880265caf00 pfn:0x265ca
[   78.154123][ T5220] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
[   78.161262][ T5220] page_type: 0xfdffffff(slab)
[   78.165938][ T5220] raw: 00fff00000000000 ffff88801a841500 ffffea00009df180 dead000000000002
[   78.174521][ T5220] raw: ffff8880265caf00 000000008080007d 00000001fdffffff 0000000000000000
[   78.183093][ T5220] page dumped because: kasan: bad access detected
[   78.189500][ T5220] page_owner tracks the page as allocated
[   78.195206][ T5220] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x52cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 1, tgid 1 (swapper/0), ts 9248500129, free_ts 9235291326
[   78.213519][ T5220]  post_alloc_hook+0x1f3/0x230
[   78.218283][ T5220]  get_page_from_freelist+0x2e4c/0x2f10
[   78.223827][ T5220]  __alloc_pages_noprof+0x256/0x6c0
[   78.229024][ T5220]  alloc_slab_page+0x5f/0x120
[   78.233697][ T5220]  allocate_slab+0x5a/0x2f0
[   78.238198][ T5220]  ___slab_alloc+0xcd1/0x14b0
[   78.242871][ T5220]  __slab_alloc+0x58/0xa0
[   78.247192][ T5220]  __kmalloc_node_track_caller_noprof+0x281/0x440
[   78.253609][ T5220]  kvasprintf+0xdf/0x190
[   78.257865][ T5220]  kobject_set_name_vargs+0x61/0x120
[   78.263169][ T5220]  kobject_add+0x113/0x220
[   78.267583][ T5220]  __irq_alloc_descs+0x544/0x960
[   78.272520][ T5220]  irq_domain_alloc_irqs_locked+0x83/0xbb0
[   78.278338][ T5220]  __irq_domain_alloc_irqs+0xaa/0x110
[   78.283760][ T5220]  __msi_domain_alloc_irqs+0x723/0x1380
[   78.289417][ T5220]  msi_domain_alloc_locked+0x52d/0xbf0
[   78.294903][ T5220] page last free pid 940 tgid 940 stack trace:
[   78.301049][ T5220]  free_unref_page+0xd19/0xea0
[   78.305822][ T5220]  vfree+0x186/0x2e0
[   78.309735][ T5220]  delayed_vfree_work+0x56/0x80
[   78.314592][ T5220]  process_scheduled_works+0xa2c/0x1830
[   78.320146][ T5220]  worker_thread+0x870/0xd30
[   78.324738][ T5220]  kthread+0x2f0/0x390
[   78.328801][ T5220]  ret_from_fork+0x4b/0x80
[   78.333221][ T5220]  ret_from_fork_asm+0x1a/0x30
[   78.338009][ T5220] 
[   78.340327][ T5220] Memory state around the buggy address:
[   78.345951][ T5220]  ffff8880265caa00: fa fc fc fc fa fc fc fc 00 fc fc fc fa fc fc fc
[   78.354013][ T5220]  ffff8880265caa80: 05 fc fc fc 05 fc fc fc 00 fc fc fc 00 fc fc fc
[   78.362071][ T5220] >ffff8880265cab00: fa fc fc fc fa fc fc fc fa fc fc fc 06 fc fc fc
[   78.370125][ T5220]                    ^
[   78.374183][ T5220]  ffff8880265cab80: fa fc fc fc fa fc fc fc 06 fc fc fc 00 fc fc fc
[   78.382250][ T5220]  ffff8880265cac00: 00 fc fc fc 00 fc fc fc 05 fc fc fc fa fc fc fc
[   78.390322][ T5220] ==================================================================
[   78.399293][ T5220] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[   78.406624][ T5220] CPU: 1 UID: 0 PID: 5220 Comm: syz-executor210 Not tainted 6.11.0-syzkaller-02574-ga430d95c5efa #0
[   78.417403][ T5220] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024
[   78.427455][ T5220] Call Trace:
[   78.430729][ T5220]  <TASK>
[   78.433654][ T5220]  dump_stack_lvl+0x241/0x360
[   78.438342][ T5220]  ? __pfx_dump_stack_lvl+0x10/0x10
[   78.443542][ T5220]  ? __pfx__printk+0x10/0x10
[   78.448214][ T5220]  ? lockdep_hardirqs_on_prepare+0x43d/0x780
[   78.454197][ T5220]  ? vscnprintf+0x5d/0x90
[   78.458532][ T5220]  panic+0x349/0x860
[   78.462432][ T5220]  ? check_panic_on_warn+0x21/0xb0
[   78.467545][ T5220]  ? __pfx_panic+0x10/0x10
[   78.471973][ T5220]  ? _raw_spin_unlock_irqrestore+0x130/0x140
[   78.477958][ T5220]  ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10
[   78.484310][ T5220]  check_panic_on_warn+0x86/0xb0
[   78.489243][ T5220]  ? smk_access+0xae/0x4e0
[   78.493656][ T5220]  end_report+0x77/0x160
[   78.497907][ T5220]  kasan_report+0x154/0x180
[   78.502417][ T5220]  ? smk_access+0xae/0x4e0
[   78.506836][ T5220]  smk_access+0xae/0x4e0
[   78.511101][ T5220]  smack_watch_key+0x2f4/0x3a0
[   78.515880][ T5220]  ? __pfx_smack_watch_key+0x10/0x10
[   78.521199][ T5220]  ? __kasan_kmalloc+0x98/0xb0
[   78.525968][ T5220]  security_watch_key+0x86/0x250
[   78.530908][ T5220]  keyctl_watch_key+0x2b7/0x480
[   78.535773][ T5220]  __se_sys_keyctl+0x106/0xa50
[   78.540542][ T5220]  ? __pfx___se_sys_keyctl+0x10/0x10
[   78.545836][ T5220]  ? _raw_spin_unlock_irq+0x23/0x50
[   78.551032][ T5220]  ? lockdep_hardirqs_on+0x99/0x150
[   78.556234][ T5220]  ? _raw_spin_unlock_irq+0x2e/0x50
[   78.561431][ T5220]  ? ptrace_notify+0x279/0x380
[   78.566197][ T5220]  ? __pfx_ptrace_notify+0x10/0x10
[   78.571319][ T5220]  ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10
[   78.577753][ T5220]  ? do_syscall_64+0x100/0x230
[   78.582520][ T5220]  ? __x64_sys_keyctl+0x20/0xc0
[   78.587369][ T5220]  do_syscall_64+0xf3/0x230
[   78.591877][ T5220]  ? clear_bhb_loop+0x35/0x90
[   78.596560][ T5220]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   78.602461][ T5220] RIP: 0033:0x7f0451b6cbf9
[   78.606889][ T5220] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 c1 17 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
[   78.626489][ T5220] RSP: 002b:00007fff281262e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000fa
[   78.634899][ T5220] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f0451b6cbf9
[   78.642867][ T5220] RDX: 0000000000000007 RSI: 0000000032bb21f7 RDI: 0000000000000020
[   78.650835][ T5220] RBP: 00007f0451bdf5f0 R08: 0000000000000000 R09: 0000000000000006
[   78.658810][ T5220] R10: 00000000000000b1 R11: 0000000000000246 R12: 0000000000000001
[   78.666785][ T5220] R13: 431bde82d7b634db R14: 0000000000000001 R15: 0000000000000001
[   78.674762][ T5220]  </TASK>
[   78.678075][ T5220] Kernel Offset: disabled
[   78.682397][ T5220] Rebooting in 86400 seconds..